kubernetes/kops · error

error listing policies for role: %w

Error message

error listing policies for role: %w

What it means

During IAMRolePolicy.Find, kops calls ListAttachedRolePolicies to discover the managed external policies attached to the role. If the AWS IAM API returns an error that is not NoSuchEntity, it is wrapped with this message. It means the IAM lookup itself failed, so the actual state of attached policies is unknown.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/iamrolepolicy.go:74

	ctx := c.Context()
	var actual IAMRolePolicy

	cloud := awsup.GetCloud(c)

	// Handle policy overrides
	if e.ExternalPolicies != nil {
		request := &iam.ListAttachedRolePoliciesInput{
			RoleName: e.Role.Name,
		}

		response, err := cloud.IAM().ListAttachedRolePolicies(ctx, request)
		if err != nil {
			if awsup.IsIAMNoSuchEntityException(err) {
				klog.V(2).Infof("Got NoSuchEntity describing IAM RolePolicy; will treat as already-deleted")
				return nil, nil
			}

			return nil, fmt.Errorf("error listing policies for role: %w", err)
		}

		var policies []string
		if response != nil && len(response.AttachedPolicies) > 0 {
			for _, policy := range response.AttachedPolicies {
				policies = append(policies, aws.ToString(policy.PolicyArn))
			}
		}
		sort.Strings(policies)

		actual.ID = e.ID
		actual.Name = e.Name
		actual.Lifecycle = e.Lifecycle
		actual.Role = e.Role
		actual.Managed = true
		actual.ExternalPolicies = &policies

		return &actual, nil

View on GitHub (pinned to 4c8573c808)

Solutions

1. Read the wrapped AWS error to identify the specific API failure (AccessDenied, Throttling, timeout)
2. Verify the calling credentials have iam:ListAttachedRolePolicies on the role
3. Retry the kops update after transient throttling/network errors (or reduce concurrent IAM calls)
4. Check that the role still exists and is not being deleted concurrently

Example fix

// IAM policy allowing the lookup
{
  "Effect": "Allow",
  "Action": ["iam:ListAttachedRolePolicies", "iam:GetRolePolicy"],
  "Resource": "*"
}

// pre-check IAM permissions
_, err := iamClient.ListAttachedRolePolicies(ctx, &iam.ListAttachedRolePoliciesInput{RoleName: aws.String(roleName)})
if err != nil { log.Fatal(err) }

err := kopsUpdate()
var re *types.ThrottlingException
if errors.As(err, &re) || isTransient(err) {
  time.Sleep(backoff); retry(kopsUpdate)
}

When it happens

Trigger: ListAttachedRolePolicies fails with network/throttling/auth errors (e.g. AccessDenied, ThrottlingException, request timeout) while finding an IAMRolePolicy that has ExternalPolicies set.

Common situations: AWS credentials lacking iam:ListAttachedRolePolicies permission; IAM rate limiting on a busy account; transient network failures or VPC endpoint issues; role deleted concurrently by another controller.

Related errors

• error creating AutoScalingGroup: %s
• error listing EventBridge rules: %v
• error getting role: %v
• error listing IAM role policies: %v
• error listing IAM role policies for %v

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/ed37149a4c640911. Report an issue: GitHub.